EAF Compliance Outsourcing in Spain

Yes. Arts. 30 and 31 of Delegated Regulation (EU) 2017/565, which Article 83 of Royal Decree 813/2023 applies to investment firms (ESIs) and to national financial advisory firms (EAFNs), allow critical or important functions, such as compliance, to be outsourced subject to conditions. CNMV Circular 1/2014 makes the delegation of control functions subject to the outsourcing requirements and requires firms to effectively oversee the delegated functions (Rule 8).

The rules do not provide for a specific CNMV authorization to outsource the compliance function of an investment firm. But the delegation is part of your organization: in the authorization application the CNMV asks how you cover the control functions, and outsourcing cannot reduce its ability to supervise (Article 85 of Royal Decree 813/2023). If you change the arrangement later, you should first assess whether you must inform the CNMV.

Yes. As a general rule, Rule 4 of Circular 1/2014 allows a single independent unit to perform the compliance and risk management functions, provided the responsibilities and tasks of each are ensured. If the nature, scale and complexity of your business justify it, you will need separate units.

Not always. Rule 4 of Circular 1/2014 does not require that unit when the only services provided are advice and the reception and transmission of orders, without powers of disposal over clients’ funds or instruments, and this is proportionate. In that case, the compliance and risk unit can take it on, or it can be delegated to the same entity that handles those functions.

To the firm that audits your annual accounts, nor, except in the case above, to the firm that handles your compliance or risk management, nor to any other firm with conflicting interests (Rule 9 of Circular 1/2014). If you belong to a group, the group’s internal audit function can take it on, subject to conditions to avoid conflicts.

Your EAF. When it outsources critical or important functions, the firm remains fully responsible for all its obligations (Art. 31 of the Delegated Regulation). That is why you need due diligence, a written contract that allows you to oversee the arrangement and terminate it when necessary, and CNMV access to the information.

A written agreement setting out the rights and obligations of the parties, the scope of the service and its reporting, the provider’s resources, access by your auditors and the CNMV to data and premises, confidentiality, service continuity, subcontracting only with your consent, and the ability to terminate it without harming the continuity or quality of the service to your clients.

ESMA’s guidelines on the MiFID II compliance function (ESMA35-36-1952), which the CNMV applies, stress that tasks are delegated but responsibility is not. They require due diligence on the provider, a function that remains permanent and oversight by senior management, and they allow for proportionality in small firms.